94b2b1d5c60b2f617a964bd7e012bb36_JaffaCakes118 | Triage

Sharing

General

Target

94b2b1d5c60b2f617a964bd7e012bb36_JaffaCakes118
Size

516KB
MD5

94b2b1d5c60b2f617a964bd7e012bb36
SHA1

3bdd968202f880edb61ecca9285bf0d05e3202aa
SHA256

82d3d147cd51437c62adac64cdf612c694505767c0d1c97eea903df5f8828e33
SHA512

26d59822b259d6492442a6b22f9e2f4295292e23064710645db14cfcfaccfde72e968077297649153d6aa6be92e8d64cf0030450bd92fe9163524f416e13d20d
SSDEEP

12288:o3A9VgGbhl9g6h45EGqgsXQP/MMgD+yCa4c1QwK1xcl2ImyG:oQVf9gEQsgM3KyCat1lKzI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94b2b1d5c60b2f617a964bd7e012bb36_JaffaCakes118

Files

94b2b1d5c60b2f617a964bd7e012bb36_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

a01aada07e1345c57ca946351da9b9d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

IsEqualGUID

comctl32

_TrackMouseEvent

urlmon

URLDownloadToFileA

wininet

InternetSetOptionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 502KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE